I'm trying to get an OpenBSD server to authenticate users using the same LDAP server the rest of my home network uses. While 'getent password' lists the users from the LDAP server as expected, I cannot log in as any of them.
I have following n my /etc/login.conf:
#
# ldap
#
ldap:\
:auth=-ldap:\
:x-ldap-server=kaitain.cory.albrecht.name,389,plain:\
:x-ldap-basedn=ou=People,dc=cory,dc=albrecht,dc=name:\
:x-ldap-filter=(&(objectclass=posixAccount)(uid=%u)):\
:tc=default:
But when I try to test a user, I get the following:
root@opensecrets:/etc# /usr/libexec/auth/login_-ldap -d -s login cory ldap
Password:
load_ssl_certs says:
cacert none
cacertdir none
usercert none
userkey none
parse_server_line buf = host
parse_server_line port == NULL, will use default
parse_server_line mode == NULL, will use default
host host, port 389, version 3
setting cert info
clearing ssl set
ldap_open(host, 389) failed
host failed, trying alternates
ldap_open failed
reject
That plus these lines from the log
Dec 17 15:30:19 <auth.warn> opensecrets.cory.albrecht.name opensecrets login_ldap: ldap_open(host, 389) failed
Dec 17 15:30:19 <auth.warn> opensecrets.cory.albrecht.name opensecrets login_ldap: ldap_open failed
make me think some how /etc/login.conf's ldap section is not being read. Changing the 389 for the port to 38389 in login.conf makes no change to the output of the faked/testing login.
I'm completely stumped as to what to do to determine what is causing login.conf to not be fully parsed and I'm kind of hoping it's something easy at which I will be terribly embarrassed for forgetting it.